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The following is claimed: 

1. A method of monitoring a plurality of security parameters for a networked 
system having a first server and at least one second server, the networked system 
having a transport communication layer, the transport communication layer having 
a master transport located on the first server, the method comprising the steps of: 

comparing a data set located within a resident program located on the at 
least one second server against a rule set generated by a user; 

generating a result forwardable to the master transport based on the step of 
comparing; 

collecting the results in the first server; and 

reporting the results from the first server to the user. 

2. The method of claim 1 wherein the first server concurrently performs other 
networking tasks during the steps of comparing, generating, collecting, or reporting. 

3. The method of claim 1 wherein the step of comparing is performed by an 
agent transport located on the at least one second server. 

4. The method of claim 3 wherein at least one second server concurrently 
performs other networking tasks during the steps of comparing, generating, 
collecting, or reporting. 
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5. The method of claim 3 further comprising : 

providing a list of one or more sensor programs for comparing data sets in a 
task list resident in the agent transport. 

6. The method of claim 5 further comprising : 
accessing, by the agent transport, the task list; and 
selecting a resident program to monitor. 

7. The method of claim 3 further comprising 

selectively accessing, by the transport agent, a sensor program on the second 
server. 

8. The method of claim 7, the step of comparing performed at least in part by 
the sensor program. 

9. The method of claim 8 further comprising: 
reordering the task list. 

10. The method of claim 8 wherein the sensor program is responsible for 
monitoring an as yet unmonitored program resident on the second server. 
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11. The method of claim 8 wherein the comparing by two or more sensor 
programs generates reportable results. 

12. The method of claim 9, the step of reordering comprising adding a sensor 
program. 

13. The method of claim 11 wherein the reportable results are combined into a 
single transportable packet. 

14. The method of claim 13 wherein the agent transport encrypts the 
forwardable result. 

15. The method of claim 14 wherein the master transport decrypts the 
forwardable result. 

16. A method for monitoring a security parameter for a network, the network 
having a first and a second server, the first server having a transport mechanism 
communicatively connected to the second server, the method comprising the steps 



monitoring at one or more times for changes to a firewall policy; 
collecting on the first server the changes to the firewall policy; 
storing the changes to the firewall policy on the first server; and 
compiling a history of the changes to the firewall policy on the first server; 
reporting the history of the firewall policy changes; and 



of: 
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the second server performing other networking tasks concurrently with the 
steps of collecting, storing, compiling, or reporting. 

17. The method of step 16, further comprising the steps of: 
monitoring whether a change is an approved change; 

archiving changes into a first report, the report identifying approved changes. 

18. The method of claim 17 further comprising the steps of: 

monitoring information on an administrator of a networking policy change; 

collecting information on the administrator of the networking policy changes; 

archiving one or more sets of information on the administrator; and 

compiling the one or more sets of information on the administrator of the 
networking policy changes, the user able to view the compiled information in a 
format determinable by the user. 

19. The method of claim 18 further comprising the steps of: 
monitoring the time of the administrator's networking policy changes; 
collecting the time of the administrator's networking policy changes; 
archiving one or more sets of times of the administrator's networking policy 

changes; and 
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compiling the one or more sets of time of the administrator's networking 
policy changes, the user able to view the compiled time in a format determinable by 
the user. 

5 20. The method of claim 19 further comprising the steps of: 

collecting the firewall policy change that is pushed to the firewall policy; 
archiving one or more sets of firewall policy information that is pushed to the 
firewall policy; and 

compiling the one or more sets of firewall policy information that is pushed to 
Jfp the firewall policy, the user able to view the compiled firewall policy information 
£S that is pushed in a format determinable by the user. 

JL 21. The method of claim 20 further comprising the step of: 

II establishing one or more baselines by an administrator for a system on the 

115 network; 

monitoring the one or more baselines established by an administrator; 
collecting information on changes to the one or more baselines into a baseline 
report; 

archiving a one or more baseline reports of the changes; and 
20 compiling the one or more baseline reports, the user able to view the compiled 

information in a format determinable by the user. 
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22. The method of claim 21 further comprising the step of: 

monitoring one or more operating system's file integrity on the network; 
collecting information on changes to the one or more operating system's file 

integrity into a file integrity report; 
5 archiving the one or more file integrity reports; and 

compiling the one or more file integrity reports, the user able to view the 

compiled information in a format determinable by the user. 



23. The method of claim 22 further comprising the step of: 
~3j) monitoring a Web server's configuration file; 

£g collecting information on changes to the Web server's configuration file into a 

CO Web Server's configuration report; 

z_ archiving the one or more Web Server's configuration reports; and 

1 1 compiling the one or more Web Server's configuration reports, the user able 

ffi5 to view the compiled information in a format determinable by the user. 

24. The method of claim 23 further comprising the step of: 
monitoring a proxy server's configuration file; 

collecting information on changes to the proxy server's configuration file into 
20 a proxy server's configuration file report; 

archiving the one or more proxy server's configuration file reports; and 
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compiling the one or more proxy server's configuration file reports, the user 
able to view the compiled information in a format determinable by the user. 



25. The method of claim 24 further comprising the step of: 
5 monitoring a user's password strength; 

collecting information on the password's strength into a password strength 
report; 

archiving the one or more password strength report; and 
compiling the one or more password strength report, the user able to view the 
3j0 compiled information in a format determinable by the user. 

C3 26. The method of claim 25 further comprising the step of: 
!L establishing a one or more events that triggers an alert; 

12 monitoring for the one or more alert triggering events; 

fiS> providing an alert notice upon the occurrence of the one or more alert 

triggering event; 



27. The method of claim 26 further comprising the steps of: 

collecting information on the one or more alert triggering event into a alert 
20 report; 

archiving the one or more alerts reports; and 
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compiling the one or more alert reports, the user able to view the compiled 
information in a format determinable by the user. 

28. The method of step 27 further comprising the step of: 

monitoring encrypted secure connections between the first and the one or 
more second servers. 
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